CVE-2024-42327

PoC for CVE-2024-42327 / ZBX-25623 A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the...

CVE-2022-45451

Introduction System Specs: Windows 10 1809 x64 EN Target: Acronis Home Cyber Protect Acronis Cyber Protect Vulnerability Description The Acronis "ngscan" anti-malware scan driver suffers from incorrect / improper access control placed on the filter communication port. The minifilter driver suppor...

CVE-2026-40083

SQL Injection in Cacti managers.php A proof-of-concept exploit for CVE-2026-40083, a SQL Injection vulnerability in Cacti's managers.php that allows any authenticated user with SNMP Manager permissions to read the entire MySQL database including user credentials and password hashes. Usage: Verify...

CVE-2023-28432

CVE-2023-28432 MinIO Information Disclosure Leaks Account Passwords The MinIO system has an information disclosure vulnerability. An unauthenticated remote attacker can obtain all sensitive information, including MINIOSECRETKEY and MINIOROOTPASSWORD, by sending a specially crafted POST request to...

CVE-2026-98943

The Linux kernel contains a vulnerability within the HID: steam component related to improper locking behavior . Specifically, the issue involves RCU accesses that are not properly guarded behind a lock. The vulnerability has been addressed through a cleanup of these locking mechanisms. No specif...

AuthMatrix

AuthMatrix v0.8.2 AuthMatrix is an extension to Burp Suite that provides a simple way to test authorization in web applications and web services. With AuthMatrix, testers focus on thoroughly defining tables of users, roles, and requests for their specific target application upfront. These tables...

CVE-2018-10933

CVE-2018-10933 libssh server authentication bypass vulnerability CVE-2018-10933 libssh是一个提供ssh相关接口的开源库，包含服务端、客户端等。其服务端代码中存在一处逻辑错误，攻击者可以在认证成功前发送MSGUSERAUTHSUCCESS消息，绕过认证过程，未授权访问目标SSH服务器。 0x00 docker for libssh vuln https://github.com/vulhub/vulhub/blob/master/libssh/CVE-2018-10933/README.md 0x01...

whatfiles

whatfiles Whatfiles is a Linux utility that logs what files another program reads/writes/creates/deletes on your system. It traces any new processes and threads that are created by the targeted process as well, and records whether each operation succeeded. Rationale: I've long been frustrated at...

CVE-2021-45232

Apache APISIX Dashboard Unauthorized Access Description This tool integrates fofa and POC one-click detection functionality, enabling one-click crawling from fofa and one-click detection crawl and test simultaneously Usage Version: python3 Before testing, you need to change your fofatoken value a...

h2csmuggler

h2cSmuggler Description h2cSmuggler smuggles HTTP traffic past insecure edge-server proxypass configurations by establishing HTTP/2 cleartext h2c communications with h2c-compatible back-end servers, allowing a bypass of proxy rules and access controls. See my detailed write-up below for: Technica...

CVE-2024-23733

CVE-2024-23733 Software AG webMethods API Integration Server 10.15.0 Incorrect Access Control Description The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before CoreFix7 allows remote attackers to reach the administration panel and...

CVE-2025-25621

CVE-2025-25621 Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing teachers to take attendance of fellow teachers through the endpoint /courses/teacher/index?teacherid=2&semesterid=1. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Naviga...

CVE-2021-21551

CVE-2021-21551 Dell Driver EoP CVE-2021-21551 Description Dell dbutil23.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required. This exploit was tested o...

trackerjacker

trackerjacker Like nmap for mapping wifi networks you're not connected to. Maps and tracks wifi networks and devices through raw 802.11 monitoring. PyPI page: https://pypi.python.org/pypi/trackerjacker Install pip3 install trackerjacker Supported platforms : Linux tested on Ubuntu, Kali, and RPi...

CVE-2023-43317

CVE-2023-43317 A normal user can elevate their privileges via the userPermissionsLIst parameter in Session Storage component. to gain unauthorized access to administrative-level resources and features. This could lead to unauthorized data access, data modification, and other actions that are...

CVE-2024-42327

Write-up CVE-2024-42327 Zabbix Vulnerability Target: 10.129.231.176 Information: I know my target is a Zabbix server. I received a default user account to log into Zabbix: user matthew passwd 96qzn0h2e1k3. This account is a default user, without additional groups or privileges. As usual, we start...

D-RAT_VB.NET_MySQL_PHP

D-RATVB.NETMySQLPHP D-RAT VB.NET+MySQL+PHP The project is composed of "D-RAT" server and client "D-STUB" Programming for the client and server languages: "VB.NET Framework 2" Database: "MySQL" Web page: "PHP" https://www.youtube.com/watch?v=opBbmQ5BRFk...

CVE-2022-1329-WordPress-Elementor-3.6.0-3.6.1-3.6.2-Remote-Code-Execution-Exploit

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Execution Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the...

RefluxFS_CVE-2026-64600

🚨 CVE-2026-64600 — RefluxFS Linux Kernel Local Privilege Escalation LPE 📖 Overview CVE-2026-64600 "RefluxFS" is a Linux kernel vulnerability affecting the RefluxFS filesystem implementation. The flaw stems from improper validation of filesystem metadata, potentially leading to kernel memory...

CVE-2021-26855-PoC

CVE-2021-26855-PoC PoC exploit code for CVE-2021-26855. Original code was developed by https://github.com/GreyOrder. CVE-2021-26855 ssrf simple use of golang exercises Affected version Exchange Server 2013 is less than CU23 Exchange Server 2016 is less than CU18 Exchange Server 2019 is less than...